MAR-10-03 03:53PM FIWIihFsn^^ West Mountain View 650 938 520^^^ T-748 P. 005/053 F-049 



Sheet I of 



fam PTO-1449 U.S. DEPARTMENT OF COMMERCE 
JsZtaS PATENT AND trademark office 


Attorney Docket Number 
HVWD-01008USO 


Serial/Patent Number 1 
09/757,963 | 


INFORMATION DISCLOSURE STATEMENT 
BY APPLICANT 


Applicant/Patent Owner J 

John S. Flowers et aL 1 


Filing/Issue Date 
January 10. 2001 


Group Art Unit 1 



U.S. PATENT DOCUMENTS 



Examiner 
Initial 



Document Number 



5392,903 



Date 



04/06/99 



Narne_ 



Klaus 



Class 



395 



Subclass 



187-0) 



FiKng Date 



09/12/96 



5,136,523 



08/04/92 



Landers 



395 



54 



03/26/91 



5,278,901 
5.802,320 



OUT 1/94 



Shich ctal. 



380 



04/3 0/92 



09/01/98 



Baebretal. 



395 



200-79 



05/18/95 



FOREIGN PATENT DOCUMENTS 



Examiner 
Initial 



Document Number 



Date 



Country 



Class 



Subclass 



TranS- 
bUon_ 



Yes No 



OTHER DOCUMENTS (Include Author, Title, Date Pertinent pages, etc ) 



Rebecca Bace, Infidel, Inc. "An Introduction to famision Detection and Assessment", 1999, 38 pages. 



Fyodor. "Remote OS detection via TCP/IP Stack FingerPrintinK", October 18, 199S, 10pagcs^_ 



Examiner 



i Initial if citation consid 



♦EXAMINER: /hiual if citation considered* whethi 
noi considered. Include copy of this form with next 1 




Date Considered 



citation fs In conformance with MPEP 609. Draw line through citation if not m conformance and 
ition to applicant. 



"1 = Copy not submitted because it was submitted in prior application SN J_ 
*2 » Copy no[ submitted because it was submitted in prior applicat ion SN _L 



.filed 
, filed 



,19 



-4- 

Attamey Docket No.; HVWIX)1008USO MEM/SBS 

Received from < 6509385200 > at 3110/03 7:18:08 PM [Eastern Standard Time] 



v PTO/SB/08A (10-01) 

Approved for use through 10/31/2002. OMB 0651-0031 
U.S. Patent and Trademark Office: U.S. DEPARTMENT OF COMMERCE 
(J Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it contains a valid OMB control number. 



f Substitute for form 1 449A/PTO 

INFORMATION DISCLOSURE 
STATEMENT BY APPLICANT 

Supplemental 



Application No. 



Complete if Known 



Filing Date 



First Named Inventor 



Art Unit 



Examiner Name 



09/757,963 



January 10, 2001 



John S. Flowers et al. 



2131 



Gail Q. Hayes 



Sheet 



1 



of 



Attorney Docket Number 



23327-06896 



U.S. PATENT DOCUMENTS 






Document No. 






Examiner 
Initials* 


Cite 
No.' 


Numbpr — Kind Cnrip 2 (if known \ 


Date 

MM-DD-YYYY 


Name of Patentee or 
Applicant of Cited Document 


ji — t 


A1 


US- 5,278,901 


01-11-1994 


Shieh et al 




A2 


US- 5,796,942 


08-18-1998 


Esbensen 




v A3 


US- 5,798,706 


08-25-1998 


Kraemer et al. 






US- 5,892,903 


04-06-1999 


Klaus 




3 A5 


US- 5,931,946 


08-03-1999 


Terada et al. 




? J A6 


US- 5,958,015 


09-28-1999 


Dascalu 




A7 


US- 5,991,881 


11-23-1999 


Conklin et al. 




A8 


US- 6,185,689 B1 


02-06-2001 


Todd, Sr. et al. 




A9 


US- 6,263,444 B1 


07-17-2001 


Fujita 




A10 


US- 6,279,113 B1 


08-21-2001 


Vaidya 




A11 


US- 6,282,546 B1 


08-28-2001 


Gleichauf et al. 




A12 


US- 6,298,445 B1 


10-02-2001 


Shostack et al. 




A13 


US- 6,301,668 B1 


10-09-2001 


Gleichauf et al. 




A14 


US- 6,321,338 B1 


11-20-2001 


Porras et al. 




A15 


US- 6,324,656 B1 


11-27-2001 


Gleichauf et al. 




A16 


US- 6,330,562 B1 


12-11-2001 


Boden et al. 




A17 


US- 6,343,362 B1 


01-29-2002 


Ptacek et al. 




A18 


US- 6,347,376 B1 


02-12-2002 


Attwood et al. 




A19 


US- 6,359,557 B2 


03-19-2002 


Bilder 




A20 


US- 6,363,489 B1 


03-26-2002 


Comay et al. 




A21 


US- 6,370,648 B1 


04-09-2002 


Diep 




, A22 


US- 6,408,391 B1 


06-18-2002 


Huff et al. 


' ' 1 A23 


US- 2002/0133721 A1 


09-19-2002 


Adjaoute 



o 



FOREIGN PATENT DOCUMENTS 






Foreign Patent Document 








Examiner 
Initials* 


Cite 
No. 1 


Country Code 3 - 
Number 4 

Kind Code 6 (if known) 


Publication Date 
MM-DD-YYYY 


Name of Patentee or 
Applicant of Cited Document 


T 6 




MR- 


WO 01/31420 A2 


05-03-2001 


Visa International Service Association 








WO 02/45380 A2 


06-06-2002 


Lancope, Inc. 







Examiner 
Signature 



Date 

Considered 



* EXAMINER: Initial if reference considered, whether or not citation is in conformance with MPEP 609. 
Draw line through citation if not in conformance and not considered. Include copy of this form with next communication to applicant. 

1 Applicant's unique citation designation number (optional). 2 See Kinds Codes of USPTO Patent Documents at www.uspto.gov or MPEP 901.04. 3 Enter Office that 
issued the document, by the two-letter code (WIPO Standard ST.3). 4 For Japanese patent documents, the indication of the year of the reign of the Emperor must 
precede the serial number of the patent document. 5 Kind of document by the appropriate symbols as indicated on the document under WIPO Standard ST. 16 if 
possible. Applicant is to place a check mark here if English language Translation is attached. 23327/06896/DOCS/l 3 1 1 658 1 



r 



PTO/SB/08A (10-01) 
Approved for use through 10/31/2002. OMB 0651-0031 
U.S. Patent and Trademark Office: U.S. DEPARTMENT OF COMMERCE 
f ,Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it contains a valid OMB control number. 



Substitute for form 1 449A/PTO 

INFORMATION DISCLOSURE 
STATEMENT BY APPLICANT 

Supplemental 



Complete if Known 



Application No. 



Filing Date 



First Named Inventor 



Art Unit 



Examiner Name 



09/757,963 



January 10, 2001 



John S. Flowers et al 



2131 



Gail O. Hayes 



.Sheet 



of 



Attorney Docket Number 



23327-06896 



OTHER REFERENCES - NON-PATENT LITERATURE DOCUMENTS 




Cite 



Include name of the author (in CAPITAL LETTERS), title of the article (when appropriate), title of the item (book, magazine, 

journal, serial, symposium, catalog, etc.), date, page(s), volume-issue number(s), publisher, city and/or country where 
published 



Abstract, W. Erhard, et al., "Network Traffic Analysis and Security Monitoring With 
UniMon", Proceeding of the IEEE Conference on High Performance Switching and 
Routing, 2000, ATM 2000, pp 439 - 46 (June 2000). 




C2 



Abstract, Dept. of Comput. Sci., California Univ., Davis, CA, USA, "A Methodology For 
Testing Intrusion Detection Systems", IEEE Transactions on Software Engineering, 
Vol. 22, Issue 10, pp 719-29 (October 1996). 



C3 



Abstract, Mounji A. Le Charlier, et al., "Distributed Audit Trail Analysis", Proceeding of 
the Symposium on Network and Distributed System Security, 1995, pp 102 - 12 (Feb 
16-17, 1995). 



C4 



Abstract, L.T. Heberlein, et al., "A Network Security Monitor" Proceeding of the 990 
IEEE Computer Society Symposium on Research in Security and Privacy, pp 296-04, 
(May 7-9, 1990). 



C5 



Abstract, Xinzhou Quin et al., "Integrating Intrusion Detection and Network 
Management", Network Operation and Management Symposium, 2002. NAOMS 2002. 
2002 IEEE/IFIP, pp 329-44 (April 15-19, 2002). 



ft/ 

1A 



C6 



Abstract, D.G. Schwartz et al., "A Case-Based Approach To Network Intrusion 
Detection", Proceeding of the 5th International Conference on Information Fusion, 
2002. Vol. 2 pp 1084 - 89 (July 8-11, 2002). 



C7 



Abstract, "Open Source Security: Opportunity or Oxymoron?" Computer, Vol. 35, Issue 
3, pp 18-21 (March 2002). 




C8 



Abstract, Liu Dihua, et al. "Data Mining For Intrusion Detection", Proceedings ICII 
2001 - Beijing 2001 International Conference on Info-Tech and Info-Net, 2001, Vol. 5, 
pp 7 - 1 2, (October 29 - November 2001 ). 



C9 



Abstract, Kai Hwang & M. Gangadharan, "Micro-Firewalls for Dynamic Network 
Security With Distributed intrusion Detection", NCA2001 IEEE International 
Symposium on Network Computing and Applications, 2001 . pp 68 - 79, (October 8 - 
10, 2001). 



C10 



Abstract, Wenke Lee Stolfo, et al., "Real Time Data Mining-Based Intrusion Detection", 
Proceedings DARPA Information Survivability Conference & Exposition II, 2001, 
DISCEX '01 . Vol. 1 , pp 89 - 1 00 (June 1 2 - 14, 2001 ). 




Examiner 
Signature 



Date 

Considered 



•EXAMINER: Initial if reference/bnsidered, whether or not citation is in conformance with MPEP 609. 

Draw line through citation if not in conformance and not considered. Include copy of this form with next communication to applicant. 

Applicant's unique citation designation number (optional). 2 See Kinds Codes of USPTO Patent Documents at www.uspto.gov or MPEP 901.04. 3 Enter Office that 
issued the document, by the two-letter code (WIPO Standard ST.3). 4 For Japanese patent documents, the indication of the year of the reign of the Emperor must 
precede the serial number of the patent document. 5 Kind of document by the appropriate symbols as indicated on the document under WIPO Standard ST. 16 if 
possible. Applicant is to place a check mark here if English language Translation is attached. 23327/06896/DOCS/l 3 1 1 658 1 



r 



PTO/SB/08A (10-01) 
Approved for use through 10/31/2002. OMB 0651-0031 
U.S. Patent and Trademark Office: U.S. DEPARTMENT OF COMMERCE 
m Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it contains a valid OMB control number. 



f Substitute for form 1 449A/PTO 

INFORMATION DISCLOSURE 
STATEMENT BY APPLICANT 

Supplemental 



Application No. 



Complete if Known 



Filing Date 



First Named Inventor 



Art Unit 



Examiner Name 



09/757,963 



January 10, 2001 



John S. Flowers et al 



2131 



Gail O. Hayes 



.Sheet 



of 



Attorney Docket Number 



23327-06896 



OTHER REFERENCES - NON-PATENT LITERATURE DOCUMENTS 


Examiner 
Initials* 


Cite 
No. 1 


Include name of the author (in CAPITAL LETTERS), title of the article (when appropriate), title of the item (book, magazine, 
journal, serial, symposium, catalog, etc.), date, page(s), volume-issue number(s), publisher, city and/or country where 

published 






C11 


Abstract, J. Burns, et al. "Automatic Management Of Network Security Policy, 
Proceedings DARPA Information Survivablity Conference & Exposition II 2001, 
DISCEX '01. Vol. 2, pp 12-26, (June 12-14, 2001) 




\ 

(- 


C12 


Abstract, Heberlein, et al. "A Network Security Monitor", 1990, Proceedings Research 
in Security & Privacy 1990 IEEE Computer Society Symposium on, pp 296 - 304, (May 
7-9, 1990). 
























/° >\ 








{- \ 
























— \ & 





















































































































































Examiner 
Signature 





Date 

Considered 




*EXAMINER: Initial if reference considered, whether or not citation is in conformance with MPEP 609. 
Draw line through citation if not in conformance and not considered. Include copy of this form with next communication to applicant. 

applicant's unique citation designation number (optional). 2 See Kinds Codes of USPTO Patent Documents at www.uspto.gov or MPEP 901.04. 3 Enter Office that 
issued the document, by the two-letter code (WIPO Standard ST.3). 4 For Japanese patent documents, the indication of the year of the reign of the Emperor must 
precede the serial number of the patent document. 5 Kind of document by the appropriate symbols as indicated on the document under WIPO Standard ST. 16 if 



possible. Applicant is to place a check mark here if English language Translation is attached. 



23327/06896/DOCS/131 1658.1 



